Skip to main content
Viktor Duma
Viktor Duma
Associate III
October 11, 2017
Question

SPWF01SA11 ERROR: SSL/TLS Error: Unable to connect (-308)

  • October 11, 2017
  • 7 replies
  • 2859 views
Posted on October 11, 2017 at 20:52

Hello! I have an issue with SPWF01SA11 one-way SSL/TLS connection. I am sure I check all similar cases here, but still can't solve my problem. I tried certificates from tutorial en.STSW-TLSpack example_2, 

tried to generate my own certificates and got

ERROR: Unable to load CA certificate. 

 And now I am trying www.geotrust.com/resources/root-certificates/#.

Through teraterm send commands:

AT+S.TLSCERT2=clean,all

OK

AT+S.SETTIME=1507665904

OK

AT+S.TLSDOMAIN=f_domain,GeoTrust Global CA

OK

AT+S.TLSCERT=f_ca,1216

-----BEGIN CERTIFICATE-----

MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT

MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i

YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG

EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg

R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9

9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq

fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv

iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU

1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+

bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW

MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA

ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l

uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn

Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS

tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF

PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un

hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV

5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==

-----END CERTIFICATE-----

OK

AT+S.TLSCERT=f_content,0

# TLS loaded CERTs:

# CA Cert: YES

# Client Cert: NO

# Client Key: NO

# Domain Name: YES - GeoTrust Global CA

AT+S.SOCKON=ssltest11.bbtest.net,443,s,ind

ERROR: SSL/TLS Error: Unable to connect (-308)

What is wrong? Please help me! I waste about week for that (((

    This topic has been closed for replies.

    7 replies

    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 12, 2017
    Posted on October 12, 2017 at 09:17

    Hello Viktor,

    seems you put as domain name the Common Name of the Certification authority (CA).

    You have to put in this field the domain name of the Server you want to connect with. Very likely you will need to use this command:

    AT+S.TLSDOMAIN=f_domain,ssltest11.bbtest.net

    but check inside the server certificate if this is the actual Common Name.

    Regards

    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 12, 2017
    Posted on October 12, 2017 at 15:07

    Adriano, thank you for your reply. I tried that case too before - doesn't work. Maybe you will see the problem with my local certificates. My steps:

    openssl genrsa -out rootCA.key 2048 \\ CA key

    openssl req -x509 -new -key rootCA.key -days 10000 -out rootCA.crt \\ CA cert

    openssl genrsa -out server.key 2048 \\ server key

    openssl req -new -key server.key -out server.csr \\ server cert

    openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt -days 5000 \\signature

    openssl x509 -in rootCA.crt -out rootCA.pem -outform PEM

    openssl s_server -key server.key -cert server.crt -tls1_2 -accept 4433 -www \\ runserver

    openssl s_client -connect localhost:4433 -CAfile rootCA.pem // Verify return code: 0 (ok) Extended master secret: yes

    openssl x509 –text –in rootCA.pem –noout // check Looks like keys work with server

    AT+S.TLSCERT2=clean,all

    OK

    AT+S.SETTIME=1507665904

    OK

    AT+S.TLSDOMAIN=f_domain,1.150

    OK

    AT+S.TLSCERT=f_ca,1254

    -----BEGIN CERTIFICATE-----

    MIIDYDCCAkigAwIBAgIJAMcDkGsvF9ndMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV

    BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX

    aWRnaXRzIFB0eSBMdGQwHhcNMTcxMDExMjAxMTA5WhcNNDUwMjI2MjAxMTA5WjBF

    MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50

    ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB

    CgKCAQEAqS2dgNi+60I2991mpne2R0wTiM6r/G4M7kqpg7iTyh0r3WddburetJju

    gAEPaShr19IDj6UoGgpc6+H5vA9/WnhT4Dse/X1NQxqK3rK8wM3lhieMT5xBcOpz

    AhJ3M0T4x3P5VnBpRV38ejZ2XSYdiAW0lQ05UDNg/OF+4MxnTsP9cR8suuRkBh+L

    dV2iFtV4F+1v/g4JN5SwwF/11j/LKw6ga+ZZwuh++rRQB1ZQKGXkJZbVrlQwXFLT

    WXw5IXsg0M3DPLP3l15LSZV/LkRlxoZGBPFKJ/EEURCViEWy+VY93h6zOWRiKUpw

    qE/6hJbpiRw6cJC3aWVGz/YrO2jzIwIDAQABo1MwUTAdBgNVHQ4EFgQUr90WDg24

    EeI6r/SD+sC46Ge6lScwHwYDVR0jBBgwFoAUr90WDg24EeI6r/SD+sC46Ge6lScw

    DwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAEnORhWbHAMs7jAeP

    tPjd7FMestgWu9FEnZ3paX1S3HyYiiKMiwe6hsCDwg6KHf5+8Kbn+seLP8urlECC

    B0HdDKzHM50MEYqNluFaUvTWAgaIBc+9gtQP2ydK7X69pgFx1cVBax6uzdEWP20X

    uq55050Y+Oxf5l69q/7nM+0pSlU79x7HYnWGcQhJq/IArQiaRjcZiv3u0NcslGez

    HX6tiHzHs9vgUaRGJ9gkrVvtML4mHMeoBUKdhmjaJUSuSFNXwkCesvKDM/Klq9bm

    aHnNXGP8P39Ez5AO+vIebXCFdrzrijoJ+iBETizta9rOFLQSiOOvXh+Y5dCdzN30

    +j4hOA==

    -----END CERTIFICATE-----

    OK

    AT+S.TLSCERT=f_content,0

    # TLS loaded CERTs:

    # CA Cert: YES

    # Client Cert: NO

    # Client Key: NO

    # Domain Name: YES - 1.150

    OK

    AT+S.SOCKON=1.150,4433,s,ind

    ERROR: Unable to load CA certificate

    I tried load certificate like ctrl+c/ctrl+v and send a file through the teraterm. But the same error.

    https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif

    ________________

    Attachments :

    rootCA.pem.zip : https://st--c.eu10.content.force.com/sfc/dist/version/download/?oid=00Db0000000YtG6&ids=0680X000006HyNK&d=%2Fa%2F0X0000000b6o%2Fs6NAlyek5hjcVD8JInYbsyAZOEZVyOiSvLpi_BTQUMo&asPdf=false

    server.crt.zip : https://st--c.eu10.content.force.com/sfc/dist/version/download/?oid=00Db0000000YtG6&ids=0680X000006HyEd&d=%2Fa%2F0X0000000b6l%2Fvkte839fKhmoxdkgkn_9fpDbmu3td3P4uvrBy1SBjek&asPdf=false

    server.key.zip : https://st--c.eu10.content.force.com/sfc/dist/version/download/?oid=00Db0000000YtG6&ids=0680X000006HyNF&d=%2Fa%2F0X0000000b6n%2FwBi0llE1t155WunwsUa1S_q7rbrYZUbkrZleNu7ysDg&asPdf=false
    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 12, 2017
    Posted on October 12, 2017 at 15:32

    Looking at your generated server certificate I've seen that you've used as Common Name (CN) field for you server certificate the string 'server'. Use that as your domain:

    AT+S.TLSDOMAIN=f_domain,server

    Usually this field is filled with the URL of the server, and the TLS protocol check if the server is actually the one claimed by the certificate.

    Let me know if this solves the issue!

    Bye

    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 12, 2017
    Posted on October 12, 2017 at 19:18

    I created new certificates on ubuntu machine (under win10) and run the server. Now I get 

    ERROR: SSL/TLS Error: Unable to connect (-150)

    and on server side 

    'bad gethostbyaddr

    140682958407320:error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure:s3_pkt.c:1210:'

    When I try to do with the same certificates on windows machine - 'ERROR: Failed to connect' and nothing from the server side.

    About change 

    'CR+LF'

     - 'CR' - doesn't work for me. Get ERROR: Unable to load CA certificate. Now, when just copy/past or send file rootCA.pem get Error: Unable to connect (-150). I believe, when server get some response, I am on the correct way )))

    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 13, 2017
    Posted on October 13, 2017 at 07:44

    Hello Viktor,

    Error -150 means 'ASN date error, current date before'. So probably you forgot to set the current date correctly or, since you've generated new certificates, you used the old configuration and setup the date as the date of your first tests...

    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 13, 2017
    Posted on October 13, 2017 at 15:20

        Thank you for your time and patience for me! Now it works. It was really difficult to save certificate properly trough the tera term. My colleague wrote the script in C#, and now I can do that with no problem. And one more question. Please suggest me the certificate for access to google.com, for example.  Now I succesful download Entrust Root Certification Authority to the device but can connect only with 

    http://www.ssllabs.com

    . Other sites device cant access and rise ERROR: SSL/TLS Error: Unable to connect (-188). 
    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 13, 2017
    Posted on October 13, 2017 at 15:33

    You're welcome! 

    If you want to access to another site, for example google.com, you'll need to download the Certification Authority certificate for that site (

    https://www.thesslstore.com/blog/how-to-view-ssl-certificate-details-in-chrome-56/

    ).

    Please note that, since the module has small flash size, it is able to handle just one CA at a time. If you want to connect to several servers you have to cleanup each time the Flash and load new certificate.

    Regards

    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 17, 2017
    Posted on October 17, 2017 at 14:51

    I am sorry, still, cant connect to google. I got the certificate from 

    https://pki.google.com/

     . Also downloaded from the browser.  Tried a lot of different certificates like Geo trust. But I can connect to 

    http://www.ssllabs.com

     with 

    Entrust Root Certificate Authority�?G2.

    Guys, what is wrong? 

    AT+S.TLSCERT2=clean,all

    OK

    AT+S.SETTIME=1508244012

    OK

    AT+S.TLSDOMAIN=f_domain,google.com

    OK

    AT+S.TLSCERT=f_ca,1501

    -----BEGIN CERTIFICATE-----

    MIIEKDCCAxCgAwIBAgIQAQAhJYiw+lmnd+8Fe2Yn3zANBgkqhkiG9w0BAQsFADBC

    MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMS

    R2VvVHJ1c3QgR2xvYmFsIENBMB4XDTE3MDUyMjExMzIzN1oXDTE4MTIzMTIzNTk1

    OVowSTELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMT

    HEdvb2dsZSBJbnRlcm5ldCBBdXRob3JpdHkgRzIwggEiMA0GCSqGSIb3DQEBAQUA

    A4IBDwAwggEKAoIBAQCcKgR3XNhQkToGo4Lg2FBIvIk/8RlwGohGfuCPxfGJziHu

    Wv5hDbcyRImgdAtTT1WkzoJile7rWV/G4QWAEsRelD+8W0g49FP3JOb7kekVxM/0

    Uw30SvyfVN59vqBrb4fA0FAfKDADQNoIc1Fsf/86PKc3Bo69SxEE630k3ub5/DFx

    +5TVYPMuSq9C0svqxGoassxT3RVLix/IGWEfzZ2oPmMrhDVpZYTIGcVGIvhTlb7j

    gEoQxirsupcgEcc5mRAEoPBhepUljE5SdeK27QjKFPzOImqzTs9GA5eXA37Asd57

    r0Uzz7o+cbfe9CUlwg01iZ2d+w4ReYkeN8WvjnJpAgMBAAGjggERMIIBDTAfBgNV

    HSMEGDAWgBTAephojYn7qwVkDBF9qn1luMrMTjAdBgNVHQ4EFgQUSt0GFhu89mi1

    dvWBtrtiGrpagS8wDgYDVR0PAQH/BAQDAgEGMC4GCCsGAQUFBwEBBCIwIDAeBggr

    BgEFBQcwAYYSaHR0cDovL2cuc3ltY2QuY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAw

    NQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL2cuc3ltY2IuY29tL2NybHMvZ3RnbG9i

    YWwuY3JsMCEGA1UdIAQaMBgwDAYKKwYBBAHWeQIFATAIBgZngQwBAgIwHQYDVR0l

    BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQDKSeWs

    12Rkd1u+cfrP9B4jx5ppY1Rf60zWGSgjZGaOHMeHgGRfBIsmr5jfCnC8vBk97nsz

    qX+99AXUcLsFJnnqmseYuQcZZTTMPOk/xQH6bwx+23pwXEz+LQDwyr4tjrSogPsB

    E4jLnD/lu3fKOmc2887VJwJyQ6C9bgLxRwVxPgFZ6RGeGvOED4Cmong1L7bHon8X

    fOGLVq7uZ4hRJzBgpWJSwzfVO+qFKgE4h6LPcK2kesnE58rF2rwjMvL+GMJ74N87

    L9TQEOaWTPtEtyFkDbkAlDASJodYmDkFOA/MgkgMCkdm7r+0X8T/cKjhf4t5K7hl

    MqO5tzHpCvX2HzLc

    -----END CERTIFICATE-----

    OK

    AT+S.TLSCERT=f_content,0

    # TLS loaded CERTs:

    # CA Cert: YES

    # Client Cert: NO

    # Client Key: NO

    # Domain Name: YES - google.com

    OK

    AT+S.SOCKON=www.google.com,443,s,ind

    ERROR: SSL/TLS Error: Unable to connect (-322)

    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 17, 2017
    Posted on October 17, 2017 at 15:36

    Hi Viktor,

    the error -322 means that the domain name is wrong. Try to use as domain name

    http://www.google.com

     

    Cheers

    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 17, 2017
    Posted on October 17, 2017 at 15:48

    I did it before.  -188 ASN sig error, no CA signer to verify certificate

    Any ideas? 

    # CA Cert: YES

    # Client Cert: NO

    # Client Key: NO

    # Domain Name: YES - www.google.com

    O

    Receive: K

    Sent: AT+S.SOCKON=www.google.com,443,s,ind

    Receive:

    ERROR: SSL/TLS Error: Unable to

    Receive: connect (-188)
    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 17, 2017
    Posted on October 17, 2017 at 16:16

    This happens because the certificate you have loaded is too big for the module's RAM availability...the module isn't able to handle certificates greater than 1.3 KBs when dealing with one-way authentication and, when using muthual authentication, the overall size of the certificates and private key should be less than 3KBs.

    Please refer to 

    http://www.st.com/content/ccc/resource/technical/document/application_note/f2/8e/ae/8f/fe/77/44/aa/DM00176553.pdf/files/DM00176553.pdf/jcr:content/translations/en.DM00176553.pdf

      for more informations...
    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 17, 2017
    Posted on October 17, 2017 at 16:26

    I read that. What can you advise me when I need do that? Use mutual connection? Thank you!

    gaibotti.adriano
    gaibotti.adriano
    Visitor II
    October 17, 2017
    Posted on October 17, 2017 at 17:13

    In this case there is no solution unfortunately...the mutual authentication is used only when the server requests it (and https doesn't use any mutual authentication).

    But consider that, usually, in a IoT scenario, clouds platforms (AWS, Azure etc.) use smaller certificates with respect to the ones used for https (the latter case is for desktop, while IoT clouds are intended for very constrained devices).

    One advice to you is to use, in case of mutual authentication, private keys and certificates ECDSA-signed that, at the same level of security of RSA-signed certificates, are smaller. For example with Amazon AWS it is possible to use them.

    Viktor Duma
    Viktor DumaAuthor
    Associate III
    October 18, 2017
    Posted on October 18, 2017 at 14:58

    I understand. Thank you for support! Yesterday I download the certificate for Amazon, according to tutorial AN4963 

    50/61 ,

    and it works. But when I do the same for other sites - doesn't work. Certificates about 1200 kb. What the secret? )))
    Terms & ConditionsAccessibility statement